Why You Should Never Paste Production JWTs into Cloud Decoders
JSON Web Tokens (RFC 7519) routinely encapsulate mission-critical authentication state: user IDs, session expiration timestamps, OAuth2 scopes, and sensitive role claims. When developers paste production JWTs or signing secrets into generic online decoders, those credentials can be logged, cached, or intercepted across remote cloud proxies.
TokenLens executes 100% inside your browser's private memory using the W3C standard WebCrypto API (window.crypto.subtle). Your tokens, HMAC secrets, and RSA public/private keys are processed entirely on your local CPU and never touch any network backend.
Whether you are debugging OAuth2/OIDC token handshakes, verifying RS256/ES256 asymmetric signatures, modifying claims to test expired sessions, or running side-by-side token diffs, TokenLens provides an instant, airtight developer studio.
Core Cryptographic & Inspection Features
🔑 Asymmetric RSA & ECDSA Verification
Verify RS256, RS384, RS512, PS256, ES256, ES384, and ES512 signatures directly using PEM certificates or JWK public keys in browser memory.
🛡️ Symmetric HMAC-SHA Verification
Validate and sign HS256, HS384, and HS512 tokens using UTF-8 or Base64/Hex secret keys with instant real-time cryptographic status badges.
⏳ Live Expiration & Claim Timers
Real-time countdown indicators for exp (Expiration), iat (Issued At), and nbf (Not Before) claims with precise relative timestamps.
✏️ Interactive Claim Re-Signing Editor
Modify header and payload JSON properties on the fly and watch the encoded Base64URL and cryptographic signature update instantly.
⚖️ Side-by-Side JWT Token Diff
Compare two JWT tokens side-by-side with color-coded diff highlights to track claim modifications across auth refresh cycles.
🔒 Zero Cloud Telemetry
No network calls, no analytics trackers, no backend storage. Your authentication tokens remain strictly on your client machine.
Frequently Asked Questions
Does TokenLens send my JWT tokens or secret keys to any backend server?
No. TokenLens operates 100% in your browser's local memory using the native WebCrypto API (window.crypto.subtle). Your tokens, private keys, and HMAC secrets never leave your device.
Which cryptographic algorithms are supported by TokenLens?
TokenLens supports HMAC algorithms (HS256, HS384, HS512), RSA algorithms (RS256, RS384, RS512, PS256), and ECDSA elliptic curve algorithms (ES256, ES384, ES512).
How does TokenLens verify RS256 public key signatures without a server?
TokenLens parses your PEM or JWK public key directly in JavaScript and uses the browser's hardware-accelerated SubtleCrypto.importKey and SubtleCrypto.verify APIs to cryptographically validate the RSA-SHA256 signature locally.
What standard claims does TokenLens inspect?
TokenLens inspects RFC 7519 standard claims including sub (Subject), iss (Issuer), aud (Audience), exp (Expiration Time), nbf (Not Before), iat (Issued At), and jti (JWT ID) with live relative countdown timers.